44ed91bdf1854b5f96515bba124491a1c906baa8dba9dd232a5fb40e31634464

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
Size 59.4MB
Sample260910-x2sbhavdjd
SHA256 44ed91bdf1854b5f96515bba124491a1c906baa8dba9dd232a5fb40e31634464
MD5 1d60d43e0d0de23e5e34825d713063ba
SHA1 7cdd461761f027174a8e24ea6570530b1dca5db5
SHA512 3e21087783523e42044b971f4cf2b5c87fd0a2d59e86b2ed7c2643859734d456e7a56302f94be183638358cff09e7d669139b5086bd6a934bec3c1aa5b1726ed
SSDEEP 196608:y/mm/mm/mm/mm/mmUHh6ImzD+FS/mm/mm/mm/mm/mmUHh6ImzD+FS/mm/mm/mm/a:WLLLy5
TLSH
T1A0D76C05F99744F1D9274170498BE27F8730BA158722CFEBE7488B5BAE23BE16C39611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
4560	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
1440	svchost_CBAABCBAAAACABABACCBCABAABACCAABBABAACBBACABABBBCCABABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBBCBCACAACCABACAACBCABACCBABBACACACCAAACBABABAABBBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe"	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBBCCCAACBBCCAABBACABCCAACCCCCAABBCCCBCAABACABAACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABCBAAAACABABACCBCABAABACCAABBABAACBBACABABBBCCABABA.exe"	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe
3460	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5556	cmd.exe
1508	cmd.exe
2480	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABCBAAAACABABACCBCABAABACCAABBABAACBBACABABBBCCABABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3500	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
Token: SeDebugPrivilege	820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 5556	2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe	92
PID 5556 wrote to memory of 3500	5556	cmd.exe	94
PID 2692 wrote to memory of 1508	2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe	95
PID 1508 wrote to memory of 3464	1508	cmd.exe	97
PID 2692 wrote to memory of 2480	2692	2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe	98
PID 2480 wrote to memory of 3460	2480	cmd.exe	100
PID 820 wrote to memory of 2136	820	svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1d60d43e0d0de23e5e34825d713063ba_coinminer_cryptbot_elex_glassworm_hijackloader_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCCCBABAAABACBCCCCABCCBCBCBAACABAAACBBCBBABBACABCBBBCBBBBCBBBBCBABCAACBBCAACBBAACBCACCBCAAAAAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACCCCBABAAABACBCCCCABCCBCBCBAACABAAACBBCBBABBACABCBBBCBBBBCBBBBCBABCAACBBCAACBBAACBCACCBCAAAAAAACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe" start= auto displayName= "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe" start= auto displayName= "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCCCCBACCCABABAAAAABCAAABABBBAACCACBBAAABABAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCACABCCCCABABBCACABABCCCACBACBBBACCCBABBBBCCAAACCBCA.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCBAAAACABABACCBCABAABACCAABBABAACBBACABABBBCCABABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCBAAAACABABACCBCABAABACCAABBABAACBBACABABBBCCABABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 71acb7f80d5634f2338ff7cce6d836e2b92f1c1a3eda83f874e974a09aebdc76
MD5 9cad8d2861b68219c1ef82296fad860c
SHA1 5c9dc5d6d66d50c5b299539059de44a0f77d92c4
SHA512 9c7f58a54a63b277692f69f3f6e01782c099998d688842f09b86ac80261088ac8b4879ef3b8beb80c66009d5125caec0c2caa4d37b8974ee14286f4b73d274b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c56015c9eb1979a78ae41dd11a622d84ed73278514043dfa8a3ef76c402ea93e
MD5 99d7ebfeba9fb45bc3ecb4ae1f224f13
SHA1 5f0dbc22845a7e31ca1de2d12ed6b47fa6db2d5a
SHA512 a1e4c52ab02d809403559c8b44ab087f713fb5bd297fa6513e1e17e022fef46f47a56012d3ab5fe06876d054d86cca2bd4ec218c6318e33f121300fb69027e6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 128733f4012ff6dbd8f8b24089da05201f83863cbbddf68560c4706e3eae9722
MD5 530f39649f6f61e67e1f36d70ae08dd0
SHA1 4807664da5cc292d8c08d7fa505155e2bd2fd84d
SHA512 e9cf38dd68dd5cb910867d96e434095870e3dc1b68b92eb413409bcffff29f7ac7957ebf034cbb55912993881a22618f646a953cacad5d6eaf39f06719a8e835
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01b1f6a2b787202fffd94cda8d63bf01b873cba472f6d5bb5414e07cf104c17d
MD5 764fa982500d61ffb958734eb470f63a
SHA1 7969c8e691e13102bc1d966576ab5cf03d946b9d
SHA512 2166bc3dabb6aa54348e06cdc4186eeca3079d20c4a6c878414d9ee035c1c7d3e564fda7f620448fe5855bfe80e180f3bc1405aeaab938f5de19c1cf6f6df878
MD5 SHA1 SHA512

Submit Download

memory/820-32-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/820-51-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/820-71-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/820-76-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/2692-34-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2692-0-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2692-60-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2692-22-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2692-11-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/2692-84-0x0000000000F50000-0x0000000000F71000-memory.dmp

Download

memory/4560-88-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download